Why does MSExchangeHMWorker.exe use clearTex and how can I solve this issue?

Question

Why does MSExchangeHMWorker.exe use clear Texen and how can I solve this issue?

This log is related to this service:

LogName=Security

EventCode=4624

EventType=0

ComputerName=*******

SourceName=Microsoft Windows security auditing.

Type=Information

RecordNumber=3745106803

Keywords=Audit Success

TaskCategory=Logon

OpCode=Info

Message=An account was successfully logged on.

Subject:

Security ID: NT AUTHORITY\SYSTEM

Account Name: *

Account Domain: *

Logon ID: 0x3E7

Logon Information:

Logon Type: 8

Restricted Admin Mode: -

Virtual Account: No

Elevated Token: No

Impersonation Level: Impersonation

New Logon:

Security ID: **

Account Name: HealthMailbox9114d76

Account Domain: *

Logon ID: 0x1903D9441

Linked Logon ID: 0x0

Network Account Name: -

Network Account Domain: -

Logon GUID: {63624362-9c4c-0506-1390-edf73bc515d5}

Process Information:

Process ID: 0x2c7c

Process Name: C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe

Network Information:

Workstation Name: *

Source Network Address: -

Source Port: -

Detailed Authentication Information:

Logon Process: Advapi

Authentication Package: Negotiate

Transited Services: -

Package Name (NTLM only): -

Key Length: 0

In Splunk, this log is fired for the so-and-so rule

I want to know why this service uses cleartext (logon type=8)

Is it a security issue? How do I fix it?

Answer 1

Hi @fahimeh firouzbakht,

Welcome to the Microsoft Q&A platform!

The MSExchangeHMWorker.exe process is a part of the Microsoft Exchange Server Health Manager service, and it's responsible for monitoring and maintaining the health of Exchange services. The event you're seeing in the security log (Event ID 4624) with Logon Type 8 indicates a "NetworkCleartext" logon, which means that the user's credentials were passed in cleartext over the network. While it's concerning to see cleartext authentication, there are a few things to consider:

1. The MSExchangeHMWorker.exe process operates within the context of internal server operations. If your Exchange server is properly segmented from public networks and only accessible by trusted internal systems, this might be less of an immediate concern.
2. Sometimes, this is the default behavior for certain internal processes within Windows and Exchange. However, it's always good practice to ensure that sensitive information is encrypted to mitigate any potential risks.
3. Ensure that all communication between Exchange server components occurs over encrypted channels. For example, using Secure Sockets Layer (SSL) or Transport Layer Security (TLS) to encrypt data in transit between Exchange components can help mitigate the risk.

To address this potential issue, you can take the following steps:

1. Ensure that Exchange services are configured to use secure methods of communication. And verify SSL/TLS settings in Exchange to ensure encrypted channels are used. The following is a example of Enforcing SSL/TLS: -Configure SSL/TLS: · Open the Exchange Management Shell. · Execute the following command to ensure the use of SSL for internal and external communications:

      Set-ReceiveConnector "Your Receive Connector Name" -AuthMechanism TLS Set-SendConnector "Your Send Connector Name" -RequireTLS $true
   

   -Verify IIS Settings: · Open the IIS Manager on the Exchange server. · Ensure that SSL settings are correctly configured for the Exchange virtual directories.
2. Ensure that Kerberos is used for authentication whenever possible, as it is a more secure method compared to NTLM.
3. Ensure that your network segments are properly secured and that sensitive systems are isolated from unnecessary exposure. And Implement proper network security controls to prevent interception of network traffic.
4. Evaluate and adjust audit policies and logs to ensure you're monitoring the right events without overlogging.
5. Ensure your Exchange server is up-to-date with the latest patches and updates, as updates often include security enhancements.

Please feel free to contact me if you have any queries.

Best,

Jake Zhang